@guangnao/claude-cli

{"schema_version":"1.7.4","id":"MAL-2026-13209","published":"2026-08-05T15:52:10Z","modified":"2026-08-06T23:29:17.541698944Z","summary":"Malicious code in @guangnao/claude-cli (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b9276dba65fd393d94c5beb06122b1297994c96bda03d940f34fcc59016e4c5b)\nThe bundled CLI at bin/claude-cli.js hardcodes a hub endpoint https://hub.client-llm.com that is concealed behind a bespoke base64+XOR decoder (function _deHub, XOR key 'gnP2p!7xQ'). The decoder is used exactly once, to reconstruct this single URL; no other strings in the bundle use it. On `claude-cli start`, this hidden hub is added by default to the active hub list (opt-out only, undocumented), while the README presents hub participation as an opt-in feature the user manually configures. Once started, the CLI opens a WebSocket to <hub>/node, and on receiving {t:\"job\", id, body} messages it POSTs the remote-supplied body to the installer's local http://127.0.0.1:<port>/v1/messages endpoint using the local API key (x-api-key header) and streams the response back over the WebSocket. In default mode this dispatches a `claude -p` child process on the installer's machine driven by attacker-controlled prompts, consuming the installer's paid Anthropic subscription and, given agentic/tool-enabled Claude sessions, exposing remote-controlled execution paths on the installer's host. The targeted obfuscation of the destination URL, the mismatch between documented opt-in behavior and actual default-on enrollment, and the remote job-dispatch channel together constitute a backdoor combined with silent relay of the installer's Claude credentials and quota.\n","affected":[{"package":{"name":"@guangnao/claude-cli","ecosystem":"npm"},"versions":["1.0.5","1.0.12","1.0.13"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"bin/claude-cli.js","sha256":"4fb35fc9c11e82f1a3aefd1162df26c7926bbb6ad69a42dc588c348fd9712259","tlsh":"17a32ca9b36a213f43ec91a0d83a5807e3b599a4240d405cf27cdddf6b5c845a1befb4"}],"package_integrity":[{"filename":"claude-cli-1.0.5.tgz","hashes":{"sha1":"44fbeea15bd0f171fc226c1b764338878c199782","sha512_sri":"sha512-Tbm/ONPRd6yAT6fS5N4ItsUJuFDxYbx0md4N3jY6GOKZzGeJYmJCMWyPERJBhv5DsZvw7cOzaH8rqFpUuNci8g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@guangnao/claude-cli/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@guangnao/claude-cli/v/1.0.12"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@guangnao/claude-cli/v/1.0.13"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015805","import_time":"2026-08-05T16:13:47.184348189Z","modified_time":"2026-08-05T15:52:10Z","sha256":"9abec58567a8030be202b713896890f1cc6d2ae2e7db6f64db327fbbe55a7241","source":"amazon-inspector","versions":["1.0.5"]},{"id":"IN-MAL-2026-016659","import_time":"2026-08-06T18:09:02.468377984Z","modified_time":"2026-08-06T15:43:48Z","sha256":"98918946c0c83f0ebad00a49a556b03c1fae32b871dc914d37b88503f00af399","source":"amazon-inspector","versions":["1.0.12"]},{"id":"IN-MAL-2026-016658","import_time":"2026-08-06T18:09:02.361048967Z","modified_time":"2026-08-06T15:43:09Z","sha256":"b9276dba65fd393d94c5beb06122b1297994c96bda03d940f34fcc59016e4c5b","source":"amazon-inspector","versions":["1.0.13"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}